United Arab EmiratesADGM Data Protection Regulations, breach notification
ADGM Data Protection Regulations 2021, personal data breach notification provisions
In force since .
A breach notification rule binding private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- An app that is a Controller established in or targeting the ADGM free zone and that suffers a personal data breach must notify the Commissioner of Data Protection without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights of natural persons.
- An app that is a Processor established in or targeting the ADGM free zone must notify the Controller without undue delay after becoming aware of a personal data breach.
These lines are LexLint's reading of the law's text. Also read by: Office of Data Protection, Abu Dhabi Global Market (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://assets.adgm.com/download/assets/ADGM+DPR+2021+Guidance+Part+5.pdf/fe422242595611efaa55be162688b39c
- Guidance body
- Office of Data Protection, Abu Dhabi Global Market
What it makes you log
Who may demand the log
Regulator
Logging duty
Section 32(5) makes the controller document every personal data breach, with the facts, its effects and the remedial action taken, so that the Commissioner can verify compliance with the section. The record is kept for every breach, whether or not it is notified. The facts, effects and remedial action are not log content values, so the contents are left empty. Section 32 sets no period for keeping the record. Section 33, the communication to the data subject, adds no record duty.
- Kind
- Explicit
- As of
- Provision
- Section 32(5)
- Trigger
- security_incident
What this law does
The ADGM Data Protection Regulations set an explicit 72-hour breach-notification rule to the Commissioner of Data Protection, language read verbatim and drawn from the same family as General Data Protection Regulation (GDPR) Art. 33, unless the breach is unlikely to pose a risk to individuals' rights.
This is the only one of the UAE's three regimes where a specific notification window was confirmed; the federal PDPL defers its timeline to unconfirmed Executive Regulations, and the DIFC Law's own breach-notification timeline (Part 7) was not individually pulled.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .